Case Insensitivity Vulnerability in Nuxt Framework by Nuxt.js

CVE-2026-114132

What is CVE-2026-114132?

The Nuxt framework is susceptible to a case insensitivity issue due to a mismatch in how it resolves pages as opposed to how Nitro matches server-side route-rule keys. This flaw allows requests that differ only by letter case to bypass intended server rules, which can prevent essential processes such as redirects and SSR handling from functioning correctly. This issue is specifically seen in versions prior to 4.6.2. By configuring router.options.sensitive to true in the nuxt.config, applications can mitigate the risk, although setting it only in app/router.options.ts will not provide the same protection since the server adheres to the nuxt.config settings. It is important to note that access checks remain independent of this case matching problem.

References